Vercel has merged its private and open-source bounty efforts into a single public program hosted on HackerOne. The private program dates back to 2022 and ran through HackerOne's VIP program, a period the company used to refine its process, targets and scope while onboarding thousands of researchers.

Earlier public efforts that fed into the consolidation include the $1 million React2Shell hacker challenge, the $1 million Vercel Sandbox hacker challenge, and the OSS bug bounty program.

Drivers behind the move

AI has changed the volume dynamics of bug bounty programs, driving an exponential increase in reports that are both valid and invalid. While some companies have responded by retreating to private programs, Vercel says public reports continue to surface real findings, and that AI widens the pool of researchers able to discover vulnerabilities. The company's stated position is to evaluate reports on their own merit.

Ahead of the launch, the security engineering team streamlined its workflow and built tooling to filter noise and speed up remediation, revising each stage from triage through shipping and verifying fixes. The team points to its private program and recent large public programs as the proving ground for those processes.

Unified scope and reporting

All products across the Vercel platform and the company's open-source projects now fall under the one program. The HackerOne Scope page carries the full coverage details.

Beyond internal process alignment, Vercel cites researcher feedback: multiple programs made disclosure confusing because there were multiple submission points. New findings in open-source projects should go to the main Vercel program, but existing submissions to the former OSS program need not be copied over — those will still be reviewed.

Submitting findings

Researchers can find bounties and guidelines on the HackerOne program page. Reports should be filed through HackerOne with clear reproduction steps; the security team reviews every submission and works with researchers through the disclosure process, with a stated commitment to fast response times and transparent communication.

Vercel thanked the researchers who report issues responsibly and acknowledged those who worked within the private program, noting that nothing changes for them.

Security hiring

The company is recruiting for its security team; applications go through its careers page filtered to Security & IT.

Contributors